Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
10-06-2024 06:39
General
-
Target
2024-06-10_2c4f2165fa102387d39662375c5e8b2c_cryptolocker.exe
-
Size
64KB
-
MD5
2c4f2165fa102387d39662375c5e8b2c
-
SHA1
0a8cc67e699f499cb7e1d5f444850b524cfa5d24
-
SHA256
254adbf5a6bda4bf9d5b961f8a97b304dd54825a91e7e71657b72d29bed46095
-
SHA512
0da09c5dd1f8ffd8d122db00f14adf9d3e756e8f90a81bd5e5b855e8910047ed337b2c630d41832f617e50b85a1492677d03781f4b958bc993864cc520d41ede
-
SSDEEP
1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiD:BbdDmjr+OtEvwDpjM8+
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_2c4f2165fa102387d39662375c5e8b2c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_2c4f2165fa102387d39662375c5e8b2c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD52e68337b84a99c5f5c36d65e636e74af
SHA11b4e94a6cc234cf1a1e4484eb41b5a2db1a39897
SHA256f4788e446899e992aba4e02edc34d921a4d4043a19723810e076035b8976609f
SHA512b311ae7ff60c85a5290ed59d114f08ce7a93d6167ed74c4f9c82a950e8d8229fe326e54509d2efb1ce7bf9e5ae22aff3a4eb7c0d1567ba491d9c8e727961d9e3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB